Skip to main content

Use of an insecure channel - Docker

Description​

The EXPOSE instruction informs Docker that the container listens on the specified network ports at runtime. Inform only the ports that your application needs and avoid exposing ports such as HTTP (80).

Impact​

Capture confidential information and credentials in plain text.

Recommendation​

Deploy the application over an encrypted communication channel, for instance, HTTPS with TLS. Always try to reduce the attack surface and use EXPOSE to mark and document only the required ports in the Dockerfile.

Threat​

Anonymous attacker on adjacent network performing a man-in-the-middle.

Expected Remediation Time​

⌚ 15 minutes.

Score​

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base​

  • Attack vector: A
  • Attack complexity: H
  • Privileges required: N
  • User interaction: R
  • Scope: U
  • Confidentiality: L
  • Integrity: N
  • Availability: N

Temporal​

  • Exploit code madurity: P
  • Remediation level: O
  • Report confidence: C

Result​

  • Vector string: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
  • Score:
    • Base: 2.6
    • Temporal: 2.4
  • Severity:
    • Base: Low
    • Temporal: Low

Code Examples​

Compliant code​

Use secure channels to deploy the application


FROM node:14-alpine AS development
ENV NODE_ENV development
WORKDIR /app
COPY package.json .
RUN npm install
COPY . .
EXPOSE 443
CMD [ "node", "app.js" ]

Non compliant code​

Some insecure channels are used to deploy the application


FROM node:14-alpine AS development
ENV NODE_ENV development
WORKDIR /app
COPY package.json .
RUN npm install
COPY . .
EXPOSE 80
CMD [ "node", "app.js" ]

Requirements​

free trial

Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.